Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to The concepts associated with risk management
Similar to The concepts associated with risk management (20)
Recently uploaded
Recently uploaded (20)
The concepts associated with risk management
- 1. Chapter 8 The concepts associated with risk management Title slide
- 2. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 2 History of risk management • Implicit part of GMP • Risk and risk management • Quality risk management : – Assessment, control, communication and review of risks – Proactively and retrospectively – Evaluation of the risk to quality • Scientific knowledge • Experience • Protection of the patient – Effort, formality and documentation • Commensurate with the level of risk • Once something has gone wrong • Before you have a problem
- 3. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 3 History of risk management • ICH Q9 – Quality Risk Management • ICH Q10 – Pharmaceutical Quality Systems • Risk management has become more of an integral part of GMP • EU GMP Chapter 1 – Pharmaceutical Quality System – “Risk” is mentioned 15 times Assess Evaluate Measure Manage Risk Management
- 4. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 4 ICH Q9 – Risk Management • ICH Q9 introduces the idea of risk management – “Quality risk management is a valuable component of an effective quality system” – Examples of various risk management methodologies – When these could be used • Risk teams – Business Development – Engineering – Regulatory Affairs – Clinical – Sales and Marketing Identifying areas of risk Suggesting possible solutions
- 5. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 5 Overview of the risk management process Initiate Quality Risk Management Process Prompt Reactive prompt Proactive risk assessment
- 6. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 6 Overview of the risk management process Initiate Quality Risk Management Process Risk Assessment Failure Mode and Effects Analysis Risk Assessment 1 – what might go wrong? 2 – what is the likelihood or probability that it will go wrong? 3 – what are the consequences or severity of the problem?
- 7. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 7 Overview of the risk management process Initiate Quality Risk Management Process Risk Assessment Risk Evaluation Risk Identification Risk Analysis What might go wrong? What has gone wrong? HAZARDS are identified Likelihood of the hazard versus the severity Ranked High, medium or low
- 8. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 8 Overview of the risk management process Initiate Quality Risk Management Process Risk Assessment Risk Control Risk Evaluation Risk Identification Risk Analysis Risk Reduction If a hazard has been deemed to be unacceptable What can be done to reduce the hazard? Design out the area An additional check
- 9. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 9 Overview of the risk management process Initiate Quality Risk Management Process Risk Assessment Risk Control Risk Evaluation Risk Identification Risk Analysis Risk Reduction Risk Acceptance Take action to reduce the risk to an acceptable limit Do nothing There will always be an element of risk Will the hazard be detected by some additional check later in the process? Will the hazard be identified by the end user?
- 10. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 10 Overview of the risk management process Initiate Quality Risk Management Process Risk Assessment Risk Control Risk Review Risk Evaluation Risk Identification Risk Analysis Risk Reduction Risk Acceptance Output / Result of the Quality Risk Management Process Review Events unacceptable Document and record At conclusion On-going review
- 11. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 11 Overview of the risk management process Initiate Quality Risk Management Process RiskManagementTools Risk Assessment Risk Control Risk Review Risk Evaluation Risk Identification Risk Analysis Risk Reduction Risk Acceptance Output / Result of the Quality Risk Management Process Review Events unacceptable RiskCommunication
- 12. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 12 Risk management tools • Risk management tools: – Basic risk management facilitation methods • Flowcharts and process mapping – Failure Mode Effects Analysis – Fault Tree Analysis – Hazard Analysis and Critical Control Points – Supporting statistical tools • Pareto charts • Histograms • Control charts • Cusums
- 13. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 13 Failure Mode Effects Analysis Action What could go wrong? Severity (S) Potential causes? Occurrence (O) Controls in place Detection (D) Risk Priority Number (RPN) Position a bottle Mis- positioned 8 Bottle positioner failing 7 Weight checker Staff 1 56 Add 20 tablets > 20 tablets 4 Doser failing 2 Weight checker 3 24 20 tablets into a plastic bottle
- 14. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 14 Failure Mode Effects Analysis Action What could go wrong? Severity (S) Potential causes? Occurrence (O) Controls in place Detection (D) Risk Priority Number (RPN) Position a bottle Mis- positioned 8 Bottle positioner failing 7 Weight checker Staff 1 56 Add 20 tablets > 20 tablets 4 Doser failing 2 Weight checker 3 24
- 15. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 15 Failure Mode Effects Analysis Action What could go wrong? Severity (S) Potential causes? Occurrence (O) Controls in place Detection (D) Risk Priority Number (RPN) Position a bottle Mis- positioned 8 Bottle positioner failing 7 Weight checker Staff 1 56 Add 20 tablets > 20 tablets 4 Doser failing 2 Weight checker 3 24 Range of action values
- 16. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 16 ICH Q9 – problems? • Risk to the patient – Other risks to consider • What risks you are actually looking at – You must consider risk to the patient • Other risks – Health and Safety risks – Financial risks – Supply risks – Looking at other areas of risk is very much in line with the more holistic view of quality that we are encouraging
- 17. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 17 Risks Missing product Missing label Missing batch number Informal risk assessments • Show the Regulatory Inspectors that you are doing it • Some degree of proactive risk assessments – Continual improvement • Informal risk assessments • Problem or change – Evidence of what you did to assess the risk – Documenting in some way
- 18. Inspired Pharma Training Ltd 10/06/13 Quality Management Systems 18 Summary • How to design a QMS – Usually based on the requirements of a standard – GMP is a very good standard – ISO take a more holistic view of quality – ISO has influenced the development of more recent GMP related quality documents • FDA’s Quality System Model and ICH Q10 • Evolve your existing system • Essential elements of an effective system – Documentation system – Suitable premises, equipment, utilities and services – Risk
Editor's Notes
- COMMENTARY: Welcome to this chapter on “The concepts associated with risk management”. In this chapter we will provide an overview of the key GMP requirements associated with risk assessment highlighted in ICH Q9 – as well as looking at areas of risk outside the scope of GMP. YOUR NOTES:
- COMMENTARY: The idea of taking decisions based on risk has been an implicit part of GMP since it was first written. The whole principle of GMP is to reduce the risk of a patient receiving product of the wrong quality. However, it is only in the past 10 years or so that the idea of risk and risk management has actually been mentioned in EU GMP in black and white. Quality Risk Management was first added to Chapter 1 of EU GMP in around 2003. It stated the following: “Quality risk management is a systematic process for the assessment, control, communication and review of risks to the quality of the medicinal product. It can be applied both proactively and retrospectively. The quality risk management system should ensure that the evaluation of the risk to quality is based on scientific knowledge, experience with the process and ultimately links to the protection of the patient. The level of effort, formality and documentation of the quality risk management process is commensurate with the level of risk”. GMP didn’t then state much more about this subject and so at this time what was covered (as we have just seen) was more as a principle rather than telling you actually how to do it. Of note though is the statement that risk management can be applied both proactively and retrospectively – in other words it is not just done once something has gone wrong (reactive or retrospectively) but can be proactive too – before you have a problem. YOUR NOTES:
- COMMENTARY: With the issuing of both ICH Q9 on Quality Risk Management and ICH Q10 on Pharmaceutical Quality Systems the concept of risk management has become more of an integral part of GMP. Following the issuing of these documents EU GMP Chapter 1 on the Pharmaceutical Quality System has also been updated with greater coverage of risk management. In fact the word “risk” is mentioned 15 times in the current (January 2013 version) of Chapter 1. It is expected that all future updates to any Chapters or Annexes of EU GMP will include statements on making decisions based on risk. YOUR NOTES:
- COMMENTARY: ICH Q9 (see ATTACHMENTS) introduces formally the idea of risk management into GMP. Within ICH Q9 it states that “Quality risk management is a valuable component of an effective quality system” and within the document it provides a number of examples of various risk management methodologies and when these could be used. It also introduces the notion of risk teams – groups of people from various parts of an organisation who can contribute to any risk assessments – using their expertise and own personnel areas of interest with risk to processes. For the first time (section 4.1) in a GMP document are Business Development, Engineering, Regulatory Affairs, Clinical and Sales and Marketing mentioned. If you do do any risk assessment it is always a good idea to do it as a group – as other people will be able to contribute to identifying areas of risk and suggesting possible solutions to mitigate the risk. YOUR NOTES:
- COMMENTARY: Within ICH Q9 is a flow diagram that provides an overview of the risk management process. The first stage is to initiate the quality risk management process. This includes defining the problem or potential problem, gathering background information and data, identifying a team and team leader and specifying timelines. Note that (not mentioned in ICH Q9) is that the process needs a prompt. It could be a reactive prompt, i.e. something has gone wrong, but remember that risk management should also be proactive, and it is a good idea to have a programme for proactive risk assessments – perhaps on a department by department basis. YOUR NOTES:
- COMMENTARY: The next part of the process is the Risk Assessment stage. The common theme here is to consider three questions: 1 – what might go wrong? 2 – what is the likelihood or probability that it will go wrong? and 3 – what are the consequences or severity of the problem? These questions are used in the risk assessment technique of Failure Mode and Effects Analysis (or FMEA), something that we will come back to later. YOUR NOTES:
- COMMENTARY: There are three stages of the Risk Assessment part. The first is risk identification. Here you identify what might go wrong or what has gone wrong? For this you can look at facts and data, historical data, analysis and opinions of experts. From this stage hazards (or potential hazards) are identified. Following on from this is risk analysis. Here you look at each hazard and identify the likelihood of the hazard versus the severity. In other words a hazard could be identified (for example putting two leaflets in a finished pack instead of one - but the severity is low, i.e. no one will get hurt by this). The next stage is risk evaluation. Here the hazard is ranked, for example high, medium or low. Sometimes a number or scoring system can be used. This allows hazards to be ranked thus allowing the identification of focus areas. YOUR NOTES:
- COMMENTARY: The next part of the process is termed risk control. In this part you assess what you are going to do about any hazards that have been identified. The first stage is risk reduction. If a hazard has been deemed to be unacceptable then ideas are suggested on what can be done to reduce the hazard. This may include designing out the problem or putting in an additional check. For example on a packaging line you may identify an area where a tablet may become trapped and this may not be spotted at line clearance – hence the risk of a rouge on the next batch. You might design out the area where it could become trapped or introduce an additional check in the line clearance procedure to check that the area is clear. There may be some hazards that you have identified where you feel that no action is required – in which case you may bypass this stage. YOUR NOTES:
- COMMENTARY: This stage is then followed by risk acceptance. In this stage you either take action to reduce the risk to an acceptable limit or do nothing (as the risk is already at an acceptable limit). It is important to remember that no process is perfect and there will always be an element of risk. Normally you accept the risk if the chances of it occurring is low and the severity (should it occur) is also low. Another aspect that can also be considered, but you need to be careful of this with pharmaceuticals, is will the hazard be detected by some additional check, sensor or test later in the process and/or will the hazard be identified by the end user (the patient) before they take the product? In many cases the chances of the patient spotting a problem is rare – but this is not always the case. For example if you have not put a cap on a bottle of cough syrup it is likely that the product will spill and that the end user (or someone) will spot the problem. This is unlikely to harm the patient (assuming that they do notice the problem and don’t use the product) but it could result in a complaint. As you can see the notion of what is a hazard and what is a risk is not always straight forwards – hence the need to use multidisciplinary teams. YOUR NOTES:
- COMMENTARY: Once all hazards have been reduced to an acceptable limit then this is near to the end of the process. You should document and record what you have done so that you have a record of the process. This is one of the outputs/ results of the quality risk management processes and this could be inspected by your regulatory inspector. Another output is a process that has been risk assessed. However this is not the end of the process and there should be a review of the whole process at its conclusion as well as an on-going review of the suitability of actions taken versus results that are generated. In other words as a result of the risk assessment have you had a reduction in problems and complaints? If not then the process should loop back to look again at the risk control and risk assessments that were done to see if they need to be looked at again. YOUR NOTES:
- COMMENTARY: At all stages of the risk assessment process there should be good two-way communication from all interested parties. In addition a variety of risk management tools are available to be used – and these are described briefly in ICH Q9. YOUR NOTES:
- COMMENTARY: There are a number of risk management tools described in ICH Q9 as well as ideas for when to use them and you should have a read of these for yourself. These include basic risk management facilitation methods (such as flowcharts and process mapping). These are very good for looking at a process as a whole rather than an item of equipment. Once you have mapped a process you can evaluate where your risks are. In addition also covered is Failure Mode Effects Analysis (FMEA) and Fault Tree Analysis (FTA) – both of engineering origin and Hazard Analysis and Critical Control Points (HACCP) – from the food industry. All of these get you to evaluate a process and analyse it. We will show you how one of these methods (FMEA) can be used next. ICH Q9 also covers (very briefly) the use of supporting statistical tools such as pareto charts, histograms, control charts and cusums. These can offer very useful data to identify problems and areas of risk. We will look at these in a later part of the course. YOUR NOTES:
- COMMENTARY: FMEA is an excellent method for looking at areas of risk – especially with an item of equipment such as a packaging line. You can use this structured approach to identify hazards, rank them and take action. Here a very simplified example is provided to give you an idea of how it works. For example with a packaging line you might be looking at the filler – which puts 20 tablets into a plastic bottle. You look at what the filler does and what can go wrong. Two actions of the filler might be to position a bottle under the filling head and add 20 tablets. You then assess what could go wrong. In this case (2 examples) the bottle could be mis-positioned or more than 20 tablets could be added. You then rank the Severity (S) of this – normally between 1 to 10 (1 is not an issue and 10 is very serious). If the bottle is mis-positioned then it might not received the correct number of tablets – so this could be ranked at (say) 8 – it’s serious, but the patient will not be harmed (although they have been short changed). If (for example) more than 20 tablets are added to the bottle you may rank this as not that serious (perhaps 4) – it’s not 1 because (of course) from a business perspective you are loosing product and from a GMP perspective you should do what you are supposed to do – consistently. YOUR NOTES:
- COMMENTARY: You then look at the potential causes of the problem and assess the chances of Occurrence (O). In this case the misaligned bottle could be caused by the bottle positioner failing. You have had some problems (every few months) with this in the past so you rank it as 7. With the filling of the bottle with more than 20 tablets then you have no history of this doser failing, but it could be happening and you don’t know it - so you rank it as 2. Finally you look at the controls currently in place and rank the chances of Detection (D). Here if the bottle is positioned incorrectly then either the weight checker further down the line will spot a problem of missing tablets and the staff should also spot that tablets are spilling onto the line. In this case the rank is 1 (likely it will be spotted). In the case of extra tablets being added then again the weight checker should spot the problem, but it might not spot 1 or 2 extra tablets – so you rank this as 3. YOUR NOTES:
- COMMENTARY: You then produce a Risk Priority Number (RPN) by multiplying the three values. In the first case you get 8 x 7 x 1 = 56 and in the second case you get 4 x 2 x 3 = 24. Now here there are only two examples – but you can see that the first issue is more important to deal with than the second one. You then move to the next stage of the process and suggest mechanisms to lower the RPN to a more acceptable level. Some firms may have ranges of actions such as values of 1 to 50 – take no action 500 to 1000 must take action now and so on. YOUR NOTES:
- COMMENTARY: One of the problems with ICH Q9 is that whilst it is great in that it encourages the use of risk assessment techniques the down side is that it only focuses on one risk – the risk to the patient. Whilst it is vitally important that we never forget this we should also remember that there are other risks to consider when doing risk assessments. ICH Q9 is good at encouraging multi-disciplined teams to perform risk assessments – but they may all look at risk differently. So when you are doing risk assessments you need to be very clear what risks you are actually looking at. From a GMP perfective you must consider risk to the patient, but if you are doing risk assessments surely it is also sensible to look at other risks, such as Health and Safety risks (potential for staff injury), financial risks (loss of product or breakage of equipment) and supply risks (if the equipment stops working and spare parts are not available for months). Looking at other areas of risk (beyond risk to the patient) is very much in line with the more holistic view of quality that we are encouraging. YOUR NOTES:
- COMMENTARY: The final point to make on risk assessment is that not only must you do it but you must be able to show the Regulatory Inspectors that you are doing it. Whilst the notion of risk assessments are relatively new then they are unlikely to insist that you have done an FMEA, for example, on every item of equipment. However there are likely to want to see some degree of proactive risk assessments as part of general continual improvement. They are also likely to want to see evidence of informal risk assessments that will occur. In other words when you have had a problem or are about to change something then they are going to want to see evidence of what you did to assess the risk. Even if you have a group of people brainstorming the possible issues that could occur this is worthwhile documenting in some way to provide evidence that you did consider the risks involved. YOUR NOTES:
- COMMENTARY: We have now provided an overview of risk management and have introduced some risk assessments techniques. This brings us to the end of this unit on “How to Design a Quality Management System”. In this unit we have covered how to design a QMS – which is usually based on the requirements of a standard or standards, be it ISO, GMP and/ or corporate requirements. We have shown how GMP is a very good standard – with its focus on product quality and the patient, and how other standards, such as ISO, take a more holistic view of quality. We have also explained how ISO has influenced the development of more recent GMP related quality documents, such as the FDA’s Quality System Model and ICH Q10. Most of you will already have a system – so you don’t need to design one, but hopefully you will have seen how these documents can give you ideas for how you can evolve your existing system to meet new regulatory needs and commercial pressures. We have also covered some of the essential elements of an effective system – having a documentation system, having suitable premises, equipment, utilities and services and (in this chapter) considering the idea of risk as a way of where to put more focus into our system. In the next unit we take this further forwards as we consider how to effectively implement a Quality Management System – in other words, once we have designed our system – how do we make it happen? YOUR NOTES: